I recently started a new consulting contract. The company I'm going the work for asked me to manually install a root certificate followed by a client certificate in order to connect to their work website. I'm on Mac and I use Chrome as my default browser. Looking in Chrome settings there's a link to manage certificates. Clicking it just opens the Mac Keychain Access app. Adding the root certificate there says
Company Name CA Root certificate authority Expires: Sunday, December 7, 2020 17:02:50 Pacific Standard Time "Company Name CA" certificate is not trusted
Reading other Q&A this seems bad
Basically when I'm on their network they can read all my internet traffic. Not that I expect them to do that, it's a small non IT company. But still, I don't like the idea.
For now I'll setup a VM and install the root cert in that and use the VM solely to access their site.
My question though is: Is their some solution they could have used that would limit things so that their root cert only works with their domain / IP address rather than having it be a root cert and all the issues that entails?
Given that authentication happens with their client cert I'm guessing the root cert is only needed to validate the client cert. If so is their some other way they could have/should have generated a client cert that wouldn't require me installing a root cert?